Security

elzawarudo Bundle

Diagnose avoidable cognitive workload in software task flows through six independent lenses covering memory, search, integration, decision, uncertainty, and recovery. Use when asked to audit cognitive load or mental effort, compare workflow variants, investigate an interface that feels mentally taxing, or verify that a redesign reduced workload. Do not use for broad product-polish audits or clinical cognitive assessment.

farmage Bundle

Use when challenging ideas, plans, decisions, or proposals using structured critical reasoning. Invoke to play devil's advocate, run a pre-mortem, red team, or audit evidence and assumptions.

farmage Bundle

Develops custom WordPress themes and plugins, creates and registers Gutenberg blocks and block patterns, configures WooCommerce stores, implements WordPress REST API endpoints, applies security hardening (nonces, sanitization, escaping, capability checks), and optimizes performance through caching and query tuning. Use when building WordPress themes, writing plugins, customizing Gutenberg blocks, extending WooCommerce, working with ACF, using the WordPress REST API, applying hooks and filters, or improving WordPress performance and security.

kbarbel640-del Bundle

Security review checklist for construction software systems. Use when building integrations, APIs, data pipelines, or dashboards for construction projects.

helderberto Bundle

Harden code proactively against vulnerabilities at the boundary where untrusted input enters the system. Use when implementing auth, handling user input, storing or transmitting sensitive data, integrating external APIs, adding file uploads, or any code that crosses a trust boundary. Don't use for reactive secret scanning (use `safe-repo`) or dependency CVE checks (use `deps-audit`).

helderberto Skill

Check dependencies for known vulnerabilities and staleness. Use when user asks to "audit dependencies", "/deps-audit", "check for vulnerabilities", or wants to check dependency health. Don't use for reviewing code quality.

helderberto Bundle

Review a GitHub Pull Request for bugs, security, performance, and code quality. Use when user asks to review a PR or wants pull request feedback. Don't use for reviewing local uncommitted changes, creating new PRs, or merging branches.

helderberto Bundle

Explore a codebase to surface architectural friction and propose refactors toward deep modules (simple interface, large implementation) as GitHub issue RFCs. Use when the user asks to audit architecture, find structural friction, or identify refactor opportunities across a codebase. Don't use for single-module interface design (use /codebase-design) or code-level review of a diff (use /code-review).

darthlinuxer Bundle

Web application testing principles. E2E, Playwright, deep audit strategies.

darthlinuxer Skill

Code review guidelines covering code quality, security, and best practices.

darthlinuxer Skill

Node.js development principles and decision-making. Framework selection, async patterns, security, and architecture. Teaches thinking, not copying.

darthlinuxer Bundle

Advanced vulnerability analysis principles. OWASP 2025, Supply Chain Security, attack surface mapping, risk prioritization.

fdu-ins Bundle

Audits Solidity liquidation mechanisms for denial of service vulnerabilities including unbounded loops over positions causing out-of-gas reverts, data structure corruption preventing liquidation, front-running to block liquidation via nonce changes or self-liquidation, pending withdrawals forcing reverts, malicious ERC721/ERC20 callback reverts, collateral in external vaults not seized, insufficient insurance fund blocking liquidation, fixed bonus exceeding available collateral, incorrect decimal handling, conflicting nonReentrant modifiers, zero value transfer reverts, token deny list issues, and single borrower edge cases

acaprino Bundle

16 macro-categories and 140+ subcategories of source-code failure modes, with CWE and OWASP mappings, fix patterns, and review frameworks. TRIGGER WHEN: an audit needs structured defect classification, a detection strategy, or severity calibration; loaded by code-auditor, security-auditor, and ui-race-auditor.

hack23 Skill

ISMS policy alignment and compliance verification for Hack23 AB security standards (ISO 27001, NIST CSF 2.0, CIS Controls v8.1)

hack23 Skill

Security incident detection, analysis, containment, and recovery per NIST SP 800-61r2 and ISO 27035

hack23 Skill

Open source governance, security badges, license compliance, SBOM, supply chain security, and vulnerability management per Hack23 Open Source Policy

hack23 Skill

GitHub Agentic Workflows (gh-aw) — markdown-defined AI automation with Copilot/Claude/Codex, safe outputs, 5-layer security, and Continuous AI patterns

hack23 Skill

Systematic vulnerability lifecycle management with SLAs aligned with OWASP, NIST, and CIS Controls for Node.js/TypeScript

hack23 Skill

Comprehensive SDLC security practices with DevSecOps automation, OWASP Top 10, supply chain security (OSSF/SLSA)

rwilson504 Skill

Gap-analyze an existing Dataverse Classic Workflow against new requirements and flag risky patterns. Use when user says "I have new requirements, what needs to change", "does this workflow meet this spec", "gap analysis", "review this workflow", "what is wrong with this workflow", "why does this loop", "is this workflow going to run away", "audit this workflow", or supplies a requirements document alongside a `.xaml`. Produces a requirement-by-requirement verdict plus a change plan, and checks the documented failure modes: infinite-loop protection (the 16-in-a-short-window rule), hierarchical Under / Not Under operator behavior, scope and run-as mismatches, and MS Learn best-practice violations. Do NOT use for plain summarization (use dataverse-classic-read) or for applying the changes (use dataverse-classic-write).

matevip Skill

Pre-commit review: security scan, quality gates, auto-fix.

genfeedai Bundle

Write and audit non-ad conversion copy that matches project brand voice: landing pages, CTAs, value propositions, pricing copy, onboarding text, and microcopy. Triggers on landing page copy, CTA rewrites, copy audits, UX writing, and value propositions.

acaprino Bundle

Validates the integrity of any Claude Code plugin marketplace. Use PROACTIVELY before any commit that modifies plugin files or marketplace.json. TRIGGER WHEN: verifying marketplace.json integrity, finding orphan plugins/skills/agents/commands, checking dependency resolution or cycles, confirming documented plugin counts still match README and docs tables, or checking naming conventions. DO NOT TRIGGER WHEN: content quality review (use marketplace-review) or scaffolding new plugins (use marketplace-scaffold-plugin / skills-creator).

acaprino Bundle

Grade and rewrite code prose against antirez's 9-type taxonomy, mapped to PEP 257. TRIGGER WHEN: the user asks to improve comments, add docstrings, review comment quality, or audit documentation in a Python codebase.

acaprino Bundle

Rulebook of MUST/DO/DON'T rules backed by real-world incident references. TRIGGER WHEN: building or reviewing SPA, PWA, mobile (iOS/Android), or desktop (Electron/Tauri) apps for security posture, architecture decisions, performance, or compliance with OWASP, Core Web Vitals, and OAuth 2.1.

acaprino Bundle

Knowledge base for structural entropy: the cost of change when one concept lives in many places. TRIGGER WHEN: the user asks "should I extract this", "who owns this rule", "is this DRY enough", "is this the wrong abstraction"; centralizing, inlining or removing a layer; auditing for duplicated domain knowledge, competing sources of truth, redundant models or derivable state stored anyway; loaded under /abstraction-architect:audit or the /senior-review:team-review abstraction dimension. DO NOT TRIGGER WHEN: the concern is formatting (use clean-code:clean-code), Python refactoring (use python-development:python-refactor), dead-code removal (use /senior-review:code-review --fix), security (use senior-review:security-auditor), contract drift (use senior-review:api-contract-auditor), or cycles, cohesion and single-file patterns (use senior-review:code-auditor and senior-review:chicken-egg-detector).

dragoon0x Skill

Audit and fix ARIA attributes. Ensures proper aria-label, aria-hidden, aria-live, and role usage throughout the interface.

dragoon0x Skill

Comprehensive design quality audit with severity ratings, specific line references, and actionable fix instructions. Deeper than /score — examines every declaration.

dragoon0x Skill

Audit visual density and whitespace balance. Checks that sections alternate between sparse and dense, avoiding uniform monotony.

dragoon0x Skill

Audit all font-family, font-size, font-weight, line-height, and letter-spacing declarations across the codebase. Find inconsistencies, banned fonts, and missing hierarchy.

dragoon0x Skill

Map all colors in the codebase. Find duplicates, near-duplicates, one-off values, and colors not in the token system.

dragoon0x Skill

Map all layout patterns. Identify grid/flexbox usage, spacing patterns, nesting depth, and responsive breakpoints across the codebase.

farmountain Bundle

Skill: Security & IAM Domain Expert

waterplanai Skill

Configures audit logging for pi-ac-audit by reviewing defaults, proposing overrides, and updating project-level or user-level audit.yaml. Triggers on keywords: configure audit, audit config, audit yaml

waterplanai Skill

Hardens package-manager supply chain configuration with minimum release age policies, dry-run gates, and optional dependency security review. Triggers on keywords: harden supply chain, supply chain security, minimum release age, package age gate